Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

77,866cataloged exploits

35,812CVEs with public exploitation

24,695lab-tested

All Exploit-DB 24,458Referência 22,573GitHub PoC 14,316VulnCheck XDB 8,722Nuclei 4,320Metasploit 3,477✓ verified onlyrecent popular risk

22,573 exploits

Referência

CVE-2026-18583

CVE-2026-18583MEDIUM

mz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-bounds

33RISK

open ↗

Referência

CVE-2016-7400

CVE-2016-7400—

Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL comm

23RISK

open ↗

Referência

CVE-2018-15768

CVE-2018-15768—

Insecure MySQL Configuration Vulnerability

23RISK

open ↗

Referência

CVE-2012-5684

CVE-2012-5684—

Cross-site scripting (XSS) vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to inject arbitrary web sc

23RISK

open ↗

Referência

CVE-2013-6923

CVE-2013-6923—

Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331

23RISK

open ↗

Referência

CVE-2013-6923

CVE-2013-6923—

Multiple cross-site scripting (XSS) vulnerabilities in Seagate BlackArmor NAS 220 devices with firmware sg2000-2000.1331

23RISK

open ↗

Referência

CVE-2015-8356

CVE-2015-8356—

Multiple SQL injection vulnerabilities in the mcart.xls module 6.5.2 and earlier for Bitrix allow remote authenticated u

23RISK

open ↗

Referência

CVE-2012-3236

CVE-2012-3236—

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applic

28RISK

open ↗

Referência

CVE-2013-1616

CVE-2013-1616—

The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbit

28RISK

open ↗

Referência

CVE-2007-3806

CVE-2007-3806—

The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbi

28RISK

open ↗

Referência

CVE-2013-3530

CVE-2013-3530—

SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers t

23RISK

open ↗

Referência✓ VexDay Proof

eCentrex VOIP Client module - 'uacomx.ocx 2.0.1' Remote Buffer Overflow

CVE-2007-4489—remotewindows

Buffer overflow in the IUAComFormX ActiveX control in uacomx.ocx 2.0.1 in the eCentrex VOIP Client module allows remote

23RISK

open ↗

Referência✓ VexDay Proof

dotCMS 1.6 - 'id' Local File Inclusion

CVE-2008-3708—webappsphp

Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. (

23RISK

open ↗

Referência✓ VexDay Proof

Advanced Electron Forum 1.0.6 - Remote Code Execution

CVE-2008-5090—webappsphp

Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code em

23RISK

open ↗

Referência✓ VexDay Proof

Sejoong Namo ActiveSquare 6 - 'NamoInstaller.dll' ActiveX Buffer Overflow

CVE-2008-0634—remotewindows

Buffer overflow in the NamoInstaller.NamoInstall.1 ActiveX control in NamoInstaller.dll 3.0.0.1, as used in Sejoong Namo

23RISK

open ↗

Referência

CVE-2014-9224

CVE-2014-9224—

Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management serve

23RISK

open ↗

Referência

CVE-2010-1352

CVE-2010-1352—

Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote

43RISK

open ↗

Referência

CVE-2010-0288

CVE-2010-0288—

A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12

28RISK

open ↗

Referência✓ VexDay Proof

PHP 5.2.4 ionCube - 'ioncube_read_file' Safe Mode / disable_functions Bypass

CVE-2007-5447—localwindows

ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_funct

23RISK

open ↗

Referência

CVE-2020-23839

CVE-2020-23839—

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpa

28RISK

open ↗

Referência✓ VexDay Proof

Coppermine Photo Gallery 1.4.18 - Local File Inclusion / Remote Code Execution

CVE-2008-3486—webappsphp

Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gall

23RISK

open ↗

Referência

CVE-2020-35754

CVE-2020-35754—

OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequentl

28RISK

open ↗

Referência

CVE-2012-4768

CVE-2012-4768—

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attac

43RISK

open ↗

Referência

CVE-2016-6754

CVE-2016-6754—

A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-

23RISK

open ↗

Referência

CVE-2011-4571

CVE-2011-4571—

SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execu

23RISK

open ↗

Referência✓ VexDay Proof

phpAuction GPL Enhanced 2.51 - 'profile.php' SQL Injection

CVE-2008-3487—webappsphp

SQL injection vulnerability in profile.php in PHPAuction GPL Enhanced 2.51 allows remote attackers to execute arbitrary

23RISK

open ↗

Referência

CVE-2010-1739

CVE-2010-1739—

SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute ar

23RISK

open ↗

Referência

CVE-2010-1744

CVE-2010-1744—

SQL injection vulnerability in product.html in B2B Gold Script allows remote attackers to execute arbitrary SQL commands

23RISK

open ↗

Referência

CVE-2009-4086

CVE-2009-4086—

CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP header

23RISK

open ↗

Referência

CVE-2020-15238

CVE-2020-15238HIGH

Local privilege escalation Blueman

41RISK

open ↗

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.